Privacy policy

Last updated: 7 November 2026

Who we are
Ly.velora is an online eyewear store run by Velora, based in Westville, KwaZulu-Natal, South Africa. We decide how your personal information is used, which makes us the responsible party under the Protection of Personal Information Act, 2013 (POPIA).
For anything in this policy, including requests to our information officer, email ly.velora@gmail.com.

What we collect
- When you order: your name, email address, phone number (if you give it), delivery and billing address, what you bought, and the order and payment status. Card details you enter at checkout go straight to our payment provider. We never see or store your full card number.
- When you email us: your email address and what you write.
- When you browse our site: your device and browser type, IP address, the pages you view, items you add to your bag, and how you reached us (for example, from a Google ad). This is collected with cookies and similar technologies (see Cookies below).
- If you tick "Email me with news and offers" at checkout: your email address for marketing.

Why we use it
- To process, deliver and support your order, including returns and refunds. This is needed to perform our contract with you.
- To answer your questions.
- To measure which of our Google ads lead to visits and orders, so we can manage our advertising. This is our legitimate interest, and you can object to it (see Your rights).
- To send you news and offers, only if you opted in. You can unsubscribe at any time.
- To prevent fraud and to meet our legal, tax and accounting obligations.
We do not sell your personal information.

Who we share it with
We share only what each provider needs to do its job:
- Shopify hosts our website and runs our checkout, order records and order emails.
- Yoco processes card payments.
- Our suppliers receive your name, delivery address, phone number (if given) and the items ordered so they can pack and ship your order. We place these orders through DSers (for our AliExpress suppliers) and the CJdropshipping app, which pass on the same details.
- Courier and delivery companies receive what they need to deliver your parcel.
- Google: the Google Ads tag on our site measures ad clicks and purchases. When you buy, our site sends Google the order value and a hashed (scrambled) version of your email address, phone number, name and billing city and postal code, so Google can match the purchase to an ad click (Google calls this enhanced conversions). Google handles this under its own privacy policy.
- Judge.me, our reviews app, receives order details and site activity so that only verified buyers can leave reviews.
- Microsoft Clarity records how visitors use our site (clicks, scrolling and the pages viewed) so we can find and fix problems. It masks text you type. Microsoft handles this under its own privacy policy.
- Authorities, when the law requires it.

Information sent outside South Africa
Some of these providers store or process information outside South Africa: for example Shopify and Google in other countries, DSers, CJdropshipping, and our suppliers in China, where your order is shipped from. We do this because it is needed to fulfil your order and run our store, as POPIA allows, and we share only what each provider needs.

Cookies
Our site and checkout use cookies:
- Essential cookies keep your bag and checkout working.
- Advertising measurement: the Google Ads tag sets cookies (such as _gcl_au) that record when you arrive from a Google ad and whether you then buy. We also save the ad click ID with your bag so a later purchase can be linked to that ad.
- Site analytics: Microsoft Clarity sets cookies (such as _clck and _clsk) to understand how visitors use our pages.
You can block or delete cookies in your browser settings. The shop still works, but we can no longer tell which ads work. You can manage how Google personalises ads at myadcenter.google.com.

How long we keep it
- Order and payment records: 5 years, because South African tax law requires us to keep them.
- Emails with us: up to 2 years after your last message.
- Marketing list: until you unsubscribe.
After that we delete the information or make it anonymous.

How we protect it
Our providers use encryption (HTTPS) and access controls, and only we can access our store records. No system is perfectly secure. If a breach affects your information, we will tell you and the Information Regulator, as POPIA requires.

Your rights
Under POPIA you can:
- ask whether we hold personal information about you, and get a copy of it;
- ask us to correct or delete it;
- object to us using it for direct marketing or ad measurement;
- withdraw any consent you gave, for example to marketing emails.
Email ly.velora@gmail.com. We reply within 30 days and may first need to confirm who you are.
If you are unhappy with how we handle your information, please tell us first. You can also complain to the Information Regulator (South Africa) at inforegulator.org.za.

Children
Our store is for adults. We do not knowingly collect information from anyone under 18.

Changes to this policy
If we change this policy, we will update this page and the date at the top.

Contact
ly.velora@gmail.com